MAL-2026-14307 Malicious code in express-route-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...

Malicious code in express-route-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...

Malicious Package

Overview express-route-engine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-53977

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

EUVD-2026-54078

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

CVE-2026-53977

OpenChamber 1.11.7 contains an unauthenticated DoS vulnerability via POST to /api/system/shutdown, triggered because the shutdown route is registered before authentication middleware in bootstrap-runtime.js. This allows remote attackers to terminate the server process and disrupt all active AI co...

PT-2026-41946

Name of the Vulnerable Software and Affected Versions hitarth-gg Zenshin versions prior to 2.7.0 Description An OS command injection flaw exists in the '/stream-to-vlc' Express route. This allows remote attackers to execute arbitrary commands on the host operating system by manipulating the url...